CISA Retires Weekly Vulnerability Bulletin, Shifts to Risk-Based Approach

Bulletin Discontinuation

The US Cybersecurity and Infrastructure Security Agency (CISA) announced the retirement of its weekly vulnerability bulletin, effective September 28. This bulletin provided a summary of new vulnerabilities recorded each week, including product names, descriptions, publication dates, severity, CVSS scores, CVE identifiers, and patch information when available.

Shift to Risk-Based Management

The discontinuation is part of CISA's pivot to a risk-based approach in vulnerability management. The previous bulletin, while comprehensive, listed thousands of vulnerabilities without specific guidance on prioritization, potentially leading to alert fatigue for defenders due to the sheer volume of flaws.

This move aligns with Binding Operational Directive (BOD) 26-04, which instructs federal agencies to prioritize vulnerabilities based on real-world risk factors, including evidence of exploitation and exposure, rather than relying solely on severity scores.

Industry Trend and KEV Catalog

The broader cybersecurity industry has been transitioning away from sole reliance on CVSS metrics, which measure theoretical technical severity. Modern risk-based frameworks prioritize active exploits, threat actor interest, and exposure levels.

CISA's Known Exploited Vulnerabilities (KEV) catalog, introduced in 2021, has become a primary reference point for defenders. The KEV list focuses strictly on bugs with documented in-the-wild exploitation, offering actionable prioritization that static weekly bulletins could not provide.

Future Vulnerability Information

Security operations centers (SOCs) that previously relied on the weekly bulletin for new vulnerability information may need to adjust their processes. CISA stated it will continue to provide risk-focused vulnerability information through its KEV catalog, alerts, and advisories.